U.S. Internet Crime Complaint Losses Reach Highest Point in Five Years
Americans lost $10.3 billion to Internet scams and crimes in 2022—the highest losses in five years, according to the FBI’s Internet Crime Complaint Center’s (IC3) annual Internet Crime Report. While the overall losses increased from $6.9 billion in 2021, the number of reports filed with the IC3 decreased 5 percent, signaling that the cost of individual incidents is on the rise.
The top type of reported crime was far and away phishing—there were 300,497 complaints related to phishing (out of 800,944 total), followed by personal data breaches (58,859), non-payment or non-delivery (51,679), extortion (39,416), and tech support scams (32,538).
Business email compromise (BEC) scams continue to be a high-cost problem. The IC3 received 21,832 BEC complaints in 2022, with adjusted losses of more than $2.7 billion. BEC scammers target businesses and individuals, prompting them to transfer funds. Scammers frequently compromise “legitimate business email accounts through social engineering or computer intrusion techniques to conduct unauthorized transfers of funds,” the report said.
“As fraudsters have become more sophisticated and preventative measures have been put in place, the BEC scheme has continually evolved in kind,” the IC3 report noted. “The scheme has evolved from simple hacking or spoofing of business and personal email accounts and a request to send wire payments to fraudulent bank accounts. These schemes historically involved compromised vendor emails, requests for W-2 information, targeting of the real estate sector, and fraudulent requests for large amounts of gift cards. More recently, fraudsters are more frequently utilizing custodial accounts held at financial institutions for cryptocurrency exchanges, or having victims send funds directly to cryptocurrency platforms where funds are quickly dispersed.”
Scammers also increasingly went after investment accounts instead of typical banking accounts in 2022. Investment fraud complaints went from $1.45 billion in 2021 to $3.31 billion in 2022, and cryptocurrency investment fraud spiked 183 percent, reaching $2.57 billion in losses in 2022. Overall, investment crimes were the costliest out of the bunch, with more than $3.3 billion in losses.
Ransomware was noted as a particular concern to IC3 because it is notoriously underreported. The center received 2,385 complaints about ransomware in 2022 with adjusted losses of more than $34.3 million. Actual losses are likely much higher. The healthcare industry was most heavily targeted for ransomware attacks (210 reported incidents), followed by critical manufacturing (157) and government facilities (115), the report said.
Some types of fraud are more likely to hit specific demographics hard. Illegal call centers defraud thousands of victims every year, the IC3 noted, but they overwhelmingly impact the elderly. Almost half of victims were more than 60 years of age (46 percent), and they experienced 69 percent of losses from this type of scam ($724 million).
Overall, people older than 60 lost the most money to Internet scams last year—$3.1 billion. However, people in the 30-39 age range made the most complaints—94,506—but they lost $1.3 billion to Internet crimes.
Other schemes with high dollar figures? Cons and romance schemes hit $735 million last year, just behind personal data breaches ($742 million). Romance schemes are trending downward, however, both in the number of complaints and the dollar losses. In 2021, cons and romance scams cost Americans $956 million.
U.S. states with greater populations reported more instances of cyber crime than other states. California had nearly double the victims of any other U.S. state, with 80,766 victims, followed by Florida (42,792), Texas (38,661), and New York (25,112). California also had high losses—more than $2 billion. In the second hardest-hit state, Floridians lost $844 million.
Not all stolen funds are lost forever, though. The IC3’s Recovery Asset Team (RAT) was established in 2018 to help financial institutions freeze funds that victims transferred to domestic accounts under fraudulent pretenses. From 2018 until the end of 2022, RAT has had a 73 percent success rate, freezing $433 million out of $590 million of potential losses in 2,838 incidents.
“In September 2022, the IC3 received a complaint filed by a victim located in the Seattle, Washington, area of a BEC who intended a wire of $650,000.00 be sent to an investor, not realizing their email account was intercepted by a hacker providing fraudulent bank account instructions,” the IC3 report noted about one incident. “The IC3 RAT immediately initiated the Financial Fraud Kill Chain (FFKC) process to freeze the fraudulent financial bank account. Further collaboration with the domestic financial institution enabled a full return to the business of approximately $645,000.00. The RAT team walked the victim through the recovery process, which enabled the return of funds.”
